The EU and UK are tackling online safety through regulation – but with different approaches – creating a challenging compliance landscape for gaming platforms to navigate. Although both instruments address online safety and may appear quite similar, compliance with one will not guarantee compliance with the other. For example, while both place significant emphasis on conducting risk assessments, the UK’s Online Safety Bill (OSB) adopts a more interventionist approach through Ofcom – the UK’s online safety regulator – and includes more standalone offences that firms would need to ensure additional compliance with (read more).

See our comparative analysis of the different regimes.

The EU’s Digital Services Act

The Digital Services Act (DSA) is a core part of the EU’s digital regulation package (read more). It imposes new online safety obligations on sites hosting content and providing online services, such as social media platforms and online marketplaces (read more).

Online platforms that are designated by the European Commission as “very large online platforms” (VLOPs) will need to comply with extensive and specific obligations as of 25 August 2023. “Very large” means 45 million or more monthly active recipients of the service in the EU (i.e. approx. 10% of the EU population). So far 17 platforms have been designated as VLOPs.

For all other online intermediaries subject to the DSA, the obligations will start to bite from 17 February 2024.

Gaming may be in scope
A game or gaming environment could fall within the DSA’s scope, depending on its functionalities. For example, where:

• a game has a clan or guild system allowing multiplayer communications - except where those communications are a minor or ancillary part of the service,
• a game enables players to create content (e.g. by recording or streaming videos of themselves or their character) and distribute it within the game, like an online video sharing platform, or
• the gaming environment contains some sort of bulletin board or social media functionality meaning the environment itself is an online platform - especially if such functionality enables communications to all the game’s users and not just a closed group.

DSA compliance obligations

New obligations under the DSA regime for online platforms include:

• reporting obligations to ensure increased transparency in relation to the content moderation they engage in,
• providing terms & conditions with clear rules in relation to the use of their service, 
• the setting up of (1) a notice and action mechanism, (2) a complaint handling system with possibility to appeal to an out-of-court dispute settlement body and (3) trusted flaggers, and
• obligations aimed at protecting children (such as the prohibition on profile-based advertisements for minors and the need to ensure a high level of privacy, safety, and security).

Significant fines for breach

Platforms not complying with their DSA obligations could be fined up to 6% of the provider’s total worldwide annual turnover.  For serious and repeated breaches, national courts could order the temporary restriction of access to the service.

The UK’s Online Safety Bill

The UK online safety position remains in flux. The UK’s alternative to the DSA is the OSB, due to become legislation this Autumn. It has evolved into a lengthy and complex bill – with further amendments to come. Below we highlight key aspects of the latest available draft.

High risk/reach gaming platforms are in scope

The OSB categorises platforms by user base and functionality to determine whether they are high risk and high reach. Online games enabling user-to-user interactions and sharing of user-generated content would constitute “user-to-user services”, which will then be categorised according to user number thresholds to be set by Ofcom.

To date, Ofcom has been responsible for the UK’s video-sharing-platforms (VSP) regime, which has touched gaming-adjacent platforms like Twitch. However, under the OSB, Ofcom will be responsible for a wider array of platforms, determining in-scope platforms and provide specific codes of practice.

In scope gaming functionalities could include online multiplayer text or video communication, content creation, virtual reality or metaverse functionality, and livestreaming. Certain user-to-user interactions such as one-to-one live aural communications are exempt.

The OSB will apply to platforms with a significant number of UK players; where the UK is a target market for the game; or where its games can be played in the UK and there is a material risk of significant harm to UK individuals.

Compliance through governance and design

All platforms will be subject to certain duties. However, for high risk and high reach platforms, compliance with the OSB entails greater obligations concerning both governance and design:

• Governance - Platforms will have to conduct risk assessments of any illegal content which they host and to specify how individuals are protected from illegal and harmful content. 
  
• Design - Firms are required to use ‘proportionate measures’ to mitigate the risk of harmful material and ‘proportionate processes’ to both prevent individuals from encountering such content and remove it where appropriate using user-reporting tools.

Addressing child safety 

Online games accessible to children or with large numbers of child players have additional obligations, such as conducting risk assessment concerning content harmful to children. Such risks could include child sexual exploitation and abuse, or financial exploitation through loot boxes, dark nudge techniques, and phishing scams of free in-game currency.

Platforms will also be required to specify whether they employ minimum age restrictions – a particular risk for the video-game industry given that age rating for video games is only mandated for retail titles, and not for digitally distributed games.

A range of enforcement powers

Platforms in breach could be fined up to the highest of either £18m or 10% of global annual turnover - even greater than under the DSA. Ofcom will also be empowered to impose more creative measures, from specific enforceable requirements to court-sanctioned service and access restriction orders.

On the horizon 

While Ofcom is likely to formally consult with the online gaming sector, the regulator has warned platforms not to wait for the passing of the OSB before starting online safety compliance.

Key steps to take 

Our tech sector lawyers can help gaming companies to comply with these new regimes. Key steps platforms in the UK and the EU can take now include:

• Following the development of the UK’s OSB and EU’s DSA.
• Conducting preliminary risk assessments.
• Establishing an open dialogue with Ofcom and the relevant EU national regulator about best practice and to offer insights into current conduct.
• Establishing compliance processes and governance.
• Appointing online safety professionals.

Visit our dedicated Gaming page to find out about our Linklaters gaming offering.